From 3f1a53bef84fca5ffb4178638db14c747231851f Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 26 Nov 2019 14:17:11 +0100 Subject: [PATCH] x86/p2m-pt: fix (latent) page table mapping leak on do_recalc() error paths There are two mappings active in the middle of do_recalc(), and hence commit 0d0f4d78e5d1 ("p2m: change write_p2m_entry to return an error code") should have added (or otherwise invoked) unmapping code just like it did in p2m_next_level(), despite us not expecting any errors here. Arrange for the existing unmap invocation to take effect in all cases. Signed-off-by: Jan Beulich Reviewed-by: George Dunlap Release-acked-by: Juergen Gross --- xen/arch/x86/mm/p2m-pt.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/mm/p2m-pt.c b/xen/arch/x86/mm/p2m-pt.c index 4491079019..eb66077496 100644 --- a/xen/arch/x86/mm/p2m-pt.c +++ b/xen/arch/x86/mm/p2m-pt.c @@ -391,21 +391,22 @@ static int do_recalc(struct p2m_domain *p2m, unsigned long gfn) if ( err ) { ASSERT_UNREACHABLE(); - goto out; + break; } } remainder -= 1UL << ((level - 1) * PAGETABLE_ORDER); } smp_wmb(); - clear_recalc(l1, e); - err = p2m->write_p2m_entry(p2m, gfn, pent, e, level + 1); - if ( err ) + if ( !err ) { - ASSERT_UNREACHABLE(); - goto out; + clear_recalc(l1, e); + err = p2m->write_p2m_entry(p2m, gfn, pent, e, level + 1); + ASSERT(!err); } } unmap_domain_page((void *)((unsigned long)pent & PAGE_MASK)); + if ( unlikely(err) ) + goto out; } pent = p2m_find_entry(table, &gfn_remainder, gfn, -- 2.39.5